#LocalPrivilegeEscalation

Vulnerability: When Microsoft Defender Becomes the Primitive - RedSun PoC. This vulnerability shows how Windows Defender file handling can be abused through filesystem races, Cloud Files APIs, and reparse points to redirect privileged writes and escalate from a low-privileged user to SYSTEM.

Original text by Alisa Belousova


Author’s note. #BlueTeam #BlueHammer #CFAPI #EndpointSecurity #ExploitResearch #LocalPrivilegeEscalation #Oplocks #redteam #ReparsePoints #SOCDetection #WindowsDefe
core-jmp.org/2026/04/vulnerability-wh...